KVKK Privacy Notice

This notice explains, in accordance with Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"), how your personal data is processed when you use LaunchUS services.

1. Data controller

Your personal data is processed by SYNCHSEA LLC, which provides the service under the LaunchUS brand ("LaunchUS"), as data controller. SYNCHSEA LLC is a limited liability company formed in the US state of Wyoming. Contact: hello@launchus.app.

As a data controller established outside Turkey, we meet our obligations to register with the Data Controllers Registry (VERBİS) and to appoint a data controller representative in Turkey as the law requires; our representative's name and address are published in this section once appointed.

2. Categories of personal data processed

When you use the service, the following categories of personal data are processed from your answers in the onboarding wizard and from the records created while the service runs:

Identity data: first name, last name, full legal name, date of birth, passport number, the passport's issuing country and its expiry date.
Identity verification data: the image of your passport scanned in Stripe's identity verification step, the details read from the document (first name, last name, date of birth, document number, issuing country and expiry date) and the result and date of the verification. Verification is based on the document scan only; no selfie is requested and no biometric matching takes place. The document image stays with Stripe; LaunchUS does not download it to its own systems and keeps only the verification result and the details read from the document. The photo on the passport page is not used for face recognition or biometric matching.
Contact data: e-mail address, phone number.
Address data: residential address (country, state/province, city, postal code and the full address in Latin characters).
Company and ownership data: desired company name and alternate name, formation state, entity type, management type, managers' names and addresses, owners' names and ownership percentages, business activity description, website, business purpose and segment selections.
EIN responsible-party data: the responsible party's name for IRS Form SS-4; SSN or ITIN, or the statement that no such number exists ("foreign"); reason for applying, business start date, expected employees, activity category, accounting year closing month. The passport number and the SSN/ITIN are stored encrypted and can be accessed only by authorised staff who need them for their work.
Registered Agent selection: whether you chose the LaunchUS Registered Agent service or, where permitted, your own Registered Agent.
Payment transaction data: the payment provider's transaction id, amount, currency, payment status, invoice details and any payment-dispute records. Your card number is entered on Stripe's forms; LaunchUS does not store it.
Promotion use: the discount or promotion code you used, the order it was applied to and when it was used.
Document and vault data: formation documents, the EIN letter, the scanned copy of the SS-4 form you signed, scanned official notices, items scanned under mail scanning and other documents uploaded to your vault.
Transaction security data: IP address, browser and device information, session and sign-in records, browser signals assessed during bot protection, audit logs.
Audience measurement data: the pages visited on the website and in the portal, the referring page, events such as buttons clicked and steps completed (never the contents of forms), browser, operating system, device type, screen size, language, approximate location (country and, where available, region and city), and a visit identifier that our statistics tool derives from the IP address, the browser information and a value that changes periodically. The IP address itself is not stored in readable form.
Communication and live support records: e-mails you send us, the messages you type and the files you attach in the live support window, the time of the chat, the link between the chat and your account if you are signed in, support requests and the replies.
Commercial message preferences: your newsletter approval, its date and channel, and the record of withdrawing it.
Google sign-in data (only if you choose "Continue with Google"): the name, e-mail address, the fact that Google has verified that address, and the Google account identifier (the fixed number Google gives your account) that Google sends us; your language preference. We do not store Google access or refresh tokens or your profile photo.
Consent records: the version of each legal text you accepted, the time of acceptance, the name you typed, and the IP address and browser information at that moment; records of withdrawing your consents.

3. Purposes of processing

Your personal data is processed to:

Create your account, verify your identity and give you secure access to the portal; if you choose "Continue with Google", open your account and sign you in with the details received from Google.
Verify your identity by passport scan before the formation filing is handed over and, where needed, screen owners and managers against sanctions lists.
Prepare the formation filing and the EIN application, review them with a human check, and have the filing submitted to the state through the LaunchUS Registered Agent service and the EIN application to the IRS.
Perform the Registered Agent service and the add-on services you order (mail scanning, business address and others); scan incoming official notices and correspondence and deliver them to you.
Take payment, issue invoices, apply promotion codes and prevent their misuse, and assess refund, cancellation and payment-dispute requests.
Show the status of your process on the dashboard and send notification e-mails.
Answer your questions through live support and e-mail.
Record and evidence your acceptance of the legal texts and your consent choices.
Keep the service secure, prevent automated attacks and misuse, and fix errors.
Meet legal obligations and respond to requests from competent authorities.
Only with your separate approval: send newsletters and campaign messages.
Measure, in aggregate, how the website and the portal are used (which pages are visited, which steps are completed) in order to improve the service.

4. Legal bases

Google sign-in data: the same legal basis as account data, i.e. conclusion or performance of a contract (Art. 5/2-c).
Identity, contact, address, company and ownership, EIN responsible-party, Registered Agent selection, document and payment transaction data: processing is directly related to the conclusion or performance of a contract (KVKK Art. 5/2-c).
Identity verification data and sanctions screening: conclusion or performance of a contract (Art. 5/2-c) and compliance with a legal obligation of the controller (Art. 5/2-ç).
Payment, invoice and consent records and responses to competent authorities: compliance with a legal obligation of the controller (Art. 5/2-ç) and establishment, exercise or protection of a right (Art. 5/2-e).
Live support records and promotion use: performance of a contract (Art. 5/2-c) and LaunchUS's legitimate interest (Art. 5/2-f).
Transaction security, bot protection and audit logs: LaunchUS's legitimate interest, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f).
Cross-border transfer: your explicit consent (KVKK Art. 9(1)).
Commercial electronic messages: your approval under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce and your explicit consent (Art. 5/1).
Aggregate audience measurement with our own statistics tool: LaunchUS's legitimate interest in understanding and improving how the service is used, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f). The tool sets no cookies, does not store your IP address in readable form, does not follow you across other websites and does not run when your browser sends a "Do Not Track" signal.
Optional analytics features that use cookies or similar records in your browser, and session replay: your explicit consent (Art. 5/1); you can withdraw it at any time in the portal. No such analytics feature is active today.

5. Recipients and cross-border transfer

By the nature of the service, your data is processed outside Turkey, mainly in the United States. The recipient categories are:

Our US-based formation and registered-agent service provider: the minimum data needed for the formation filing, the Registered Agent service, the EIN application and mail scanning.
Hosting and storage providers: the application servers run with a hosting provider located in the United States; web traffic passes through the Cloudflare content-delivery and security network (which sees request data but not vault documents); bot protection on the waitlist, registration and sign-in forms is provided by the same network's tool (Cloudflare Turnstile); documents and backups are stored with private access in a cloud object-storage service located in the United States (us-east-1 region).
Payment service provider (Stripe, US): taking payment and processing refunds and payment disputes.
E-mail delivery provider: delivering account, process and notification e-mails.
Public authorities: the competent authority of the formation state and the IRS receive the application data through our service provider.
Audience measurement (Umami, our own server, US): the audience measurement data described above, without form contents, for visitors whose browser does not send a "Do Not Track" signal; it does not depend on the Analytics Cookie Consent. The tool runs on our own server in our US hosting infrastructure and sets no cookies; the data is not passed to an analytics company or any other third party and is not used for advertising.
Identity verification provider (Stripe Identity, US): the scanned image of your passport and the details read from it, only to carry out the identity verification.
Live support (Chatwoot, our own server, US): your chat messages and attached files are kept in support software running on our own server in our US hosting infrastructure; they are not passed to a third-party support company.
Commercial Message Management System (İYS, Turkey): if you have approved commercial messages, your approval and withdrawal records are reported to İYS as the law requires.
Google (Google LLC, US), only if you sign in with Google: your sign-in is verified through your Google account; during sign-in Google sends us the Google sign-in data listed above. LaunchUS does not send Google any other data from your account.
Legal advisers, auditors and competent public bodies: to the extent needed in the case of a legal claim, an audit or a legal obligation.

Our formation and registered-agent service provider acts as a separate data controller for its own legal obligations, such as the state record and service of process; the hosting, storage, e-mail and payment providers process the data only on our instructions (processors). Because the Personal Data Protection Board has published no adequacy decision for the United States, the cross-border transfer relies on your explicit consent under KVKK Art. 9(1), which is collected at registration with a separate text. Contracts with recipients include data-security and purpose-limitation obligations. Details are in the International Data Transfer Notice.

6. Method of collection

Your data is collected by fully or partly automated means through the forms in the portal and the onboarding wizard, the details Google sends during sign-in if you choose "Continue with Google", Stripe's identity verification step, the documents you upload, the e-mails you send us, the live support window and the technical records created automatically while you use the service (including bot protection).

7. Retention periods

Your personal data is kept for as long as the purpose of processing requires and for the limitation periods set by the applicable law; it is then deleted, destroyed or anonymised. The periods per category are:

Account and application data: for as long as your account is open; after your account is closed, the "After account closure" rule below applies.
Identity verification data: the document image stays with Stripe, and 30 days after verification we ask Stripe to redact the verification record (delete the images); the verification result and document details kept by LaunchUS are kept for the same period as account and application data.
Document and vault data: for as long as your account is open; deleted when your account is closed. When the Registered Agent service ends, you can still access the documents for at least 90 days.
Payment and invoice records: for the period tax and commercial law requires, at most 10 years.
Live support records: 24 months; then deleted or anonymised.
Audience measurement data: raw usage events 12 months, aggregated (statistical) data 24 months.
Commercial message approval records: 3 years after the approval ends.
Consent and audit records (including the IP address and browser information at acceptance): 10 years after the relationship ends.
Google sign-in data: for as long as your account exists, the same period as account data; the Google link is deleted when your account is deleted or when you remove the link.
After account closure: data other than records that must be kept by law is deleted or anonymised, backups included, within 6 months of closure at the latest.
Information that must be kept under US transparency rules (BOI/CTA): only to the extent and for the period those rules require.

8. Your rights

Under KVKK Article 11 you have the right, by applying to LaunchUS, to:

learn whether your personal data is processed,
request information about it if it is,
learn the purpose of processing and whether the data is used in line with that purpose,
know the third parties to whom it is transferred in Turkey or abroad,
request correction if it is incomplete or inaccurate,
request erasure or destruction under the conditions of KVKK Article 7,
request that corrections, erasure and destruction be notified to the third parties to whom the data was transferred,
object to a result that is to your detriment and arises from analysis exclusively by automated systems,
claim compensation for damage caused by unlawful processing.

If your application is rejected, you find the answer insufficient or no answer is given in time, you can file a complaint with the Personal Data Protection Board under KVKK Article 14.

9. How to apply

You can send requests about your rights to hello@launchus.app with enough information for us to verify your identity. Your application should state your first name, last name, contact address and the subject of your request; sending it from the e-mail address registered to your account makes it easier for us to verify your identity. We answer your application as soon as possible depending on its nature and within thirty days at the latest, as a rule free of charge (KVKK Art. 13); if the request involves an additional cost, the fee in the tariff set by the Board may be charged. You can withdraw your optional consents in the portal (analytics and session replay) at any time. You can stop audience measurement in your browser at any time by switching on its "Do Not Track" setting, and you can object to it by writing to the same address.

10. Data security and breach notification

The technical and organisational measures we take to protect your data are described in the Privacy Policy. If your personal data is obtained by others unlawfully, we notify you and the Board as soon as possible under KVKK Article 12/5.

11. Closing your account

You can ask for your account to be closed by writing to hello@launchus.app. When your account is closed, your data is deleted or anonymised except for the records that must be kept by law. We recommend that you download the documents in your vault before closing your account. If an order or a subscription is still running, its status is settled with you before closure.

Signing in with Google is optional; you can always sign in to your account with your e-mail address and password instead. When your account is closed, the link to your Google account is deleted as well. You can also ask for the link to be removed by writing to hello@launchus.app.

12. Changes to this notice

This notice carries a version number and an effective date. On a material change a new version is published and announced in the portal with a "what changed" line.

Version: v2.1 · Effective from: 2026-10-31 · Locale: en

Privacy Notice (KVKK)